SCIM group sync → project roles

SCIM provisioning (Admin → SCIM) keeps users and groups in sync with your IdP, but syncing a group alone grants no project visibility — see Core concepts for why config-mapped groups and role_bindings rows are independent. This page is the missing link: how to take a SCIM-synced group and bind it to a project role, so every member of that group sees the project immediately, with no per-user action.

1. Provision the group via SCIM

Entra ID (P1 or higher)

1. Enterprise applications → your app → Provisioning, same bearer token and tenant URL as the SCIM admin page setup for users.
2. Under Mappings, confirm Provision Azure Active Directory Groups is enabled (it is off by default on some app templates).
3. In Provisioning → assigned users and groups, assign the group, not just individual users — Entra only pushes a Group SCIM resource (and its members) for groups actually in scope.
4. Run Provision on demand (or wait for the ~40 min sync cycle) and confirm the group appears under Provisioning logs with a Success create Group event.

authentik

1. Directory → Groups — create or pick the group, add members.
2. Applications → Providers → Create → SCIM Provider, point it at https://<domain>/scim/v2 with the same bearer token as the SCIM admin page.
3. Applications → your app → Bindings, bind the SCIM provider, and under the provider's User/Group filtering make sure the group is included (authentik's default SCIM provider syncs all directory groups unless scoped).
4. Trigger a sync from the provider's Sync tab and confirm the group shows a green sync status.

Either way, the group now exists in OrbitalReg's groups table — confirm it under Admin → Permissions, described next.

2. Bind the group to a project role

1. Admin → Permissions → Add binding.
2. Target: Group (name). Once at least one SCIM-synced group exists, this field is a dropdown sourced from GET /api/admin/permissions/groups (org_admin-only) — pick the synced group by name instead of typing it. This matters: a free-text group name that doesn't exactly match what the IdP sends creates a new, never-synced group that silently grants nothing.
3. Pick the Project (or leave "— org-wide —") and the Role, then Add binding.

No further action is needed — role_bindings.group_id is now bound, and visibility.go's group join picks it up on the member's next request.

3. Verify

• As the group member: log out and back in, then check https://<domain>/auth/whoami — the project should appear in the visible-projects list without any per-user binding.
• As org_admin: the binding shows up in Admin → Permissions under the bound project (or "org-wide"), with the group's member count visible in the dropdown next time you add another binding.
• If the member still sees nothing: confirm the SCIM sync actually ran (Entra provisioning logs / authentik sync status show a Success group event, not just users), and that GET /api/admin/permissions/groups lists the group with a non-zero member count — a 0 here means SCIM synced the group but not its membership.